BGH: Mobile providers may transfer customer data to Schufa

German mobile providers are allowed to pass on so-called positive data about their customers to credit rating agencies like Schufa. Contrary to the legal opinion of the German Data Protection Conference, explicit customer consent is not required. This is because the data transfer is for the purpose of fraud prevention, which is covered by the General Data Protection Regulation (GDPR). This was decided by the Federal Court of Justice (Bundesgerichtshof, BGH) in a case brought by the consumer advocacy group Verbraucherzentrale Nordrhein-Westfalen against Vodafone. Parallel proceedings against Deutsche Telekom and Telefónica Germany have also been concluded with the same outcome.

Positive data primarily informs about which company has concluded how many contracts with whom. It must be distinguished from negative data, which provides information about breaches of contract, especially unpaid bills. The consumer advocacy group NRW considered it unlawful for positive data of customers who do everything correctly and properly to be sent to Schufa without their request. Non-binding statements from the Data Protection Conference (Conference of Independent Data Protection Authorities of the Federal States, DSK) from 2021 supported this interpretation of the GDPR.

However, the courts have no objections to the transfer of positive data. Following the District Court and the Higher Regional Court, the Federal Court of Justice (BGH) has also ruled in favor of Vodafone (Ref. No. VI ZR 431/24). "The transfer of personal positive data (here: master data of consumers required for identity verification, as well as information that a contractual relationship has been established or terminated with them) by a mobile service provider to a credit reporting agency can be justified according to Art. 6 para. 1 subpara. 1 letter f GDPR by the interest in fraud prevention," reads the operative part of the BGH ruling.

Fraud risk influences balancing of interests

The aforementioned GDPR passage requires a balancing of interests between the data processor and the data subject. Therefore, the BGH decision does not apply generally to all industries or contract types. In the proceedings, Vodafone was able to demonstrate that there are fraudsters who take out numerous mobile phone contracts in a very short period to obtain smartphones; then these "customers" disappear.

Data transfer to Schufa actually helps against this fraud scheme because Schufa collects data from all reputable providers and, in the course of data exchange, also reveals how many such contracts have already been registered for the same customer. Therefore, the interest of the data subjects in the secrecy of their contract conclusions does not outweigh the interest of mobile providers in protecting themselves from expensive fraud. Furthermore, the BGH points out that fraud prevention is also in the interest of the customers: more fraud would mean higher prices.

Does not apply generally

At the same time, the BGH does not fundamentally contradict the legal opinion of the DSK. Just like the DSK, the BGH also requires a balancing of interests. However, the DSK "did not (include) the specific purpose of fraud prevention, at least not explicitly."

Even the Higher Regional Court distinguished the case of mobile providers who pre-finance expensive hardware from energy suppliers who merely do not want thrifty customers who frequently switch providers. In the latter case, there is no high risk of damage that justifies data transfer, but there is with mobile phone financiers. This significantly influences the balancing of interests. The BGH ruling therefore by no means opens all data floodgates towards credit rating agencies.

What Schufa does with the data otherwise is another matter. The BGH expressly did not have to deal with this. The specific proceedings concerned the application by the Verbraucherzentrale NRW for an injunction against Vodafone, not an examination of Schufa's practices.

(ds)